Repository navigation
Merge to main - #21
Merged
Merged
Conversation
Add custom field support
* Update generated docs * Fix for issues with * Test * Added template parameter configuration via REST gateway. Fixed bug with email used for verification. Changed docs and enrollment field/template parameter names. See changelog. * Update generated docs * Fixed broken logging. * Incremental sync support added using csc date filter so sync timing can run faster that default full sync periods * Update generated docs * Fixes for Incremental Sync * Update CHANGELOG.md --------- Co-authored-by: Mikey Henderson <4452096+fiddlermikey@users.noreply.github.com> Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Brian Hill <bhill@keyfactor.com> Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com>
…cglobal-caplugin into feature/dns-plugins
CSC DCV requires a CNAME record, so resolve a DNS provider advertising the 'cname' validation type (e.g. GoDaddyCnameDomainValidator) rather than the ACME 'dns-01'/TXT variant. Docs updated to call out the CNAME validator and warn against selecting the TXT validator for CSC domains.
) * Fix NullReferenceException in GetEnrollmentResult for null DCV email The condition for adding DCV email entries to the cnames dictionary was inverted (string.IsNullOrEmpty instead of !string.IsNullOrEmpty), causing cnames.Add(null, null) and an ArgumentNullException on every enrollment where CSC returned a DcvDetail with email=null (typical for EMAIL DCV orders that have actionNeeded=N, and for CNAME-only DCV). Inverts the condition and adds a ContainsKey guard to mirror the existing CName branch. * Update generated docs --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
Adds the standard Enabled boolean field to the CA Connection settings, matching the pattern used by every other Keyfactor CA plugin (SSL Store, Digicert, HydrantId, GCP CAS, Idnomic, etc.). Purpose: allow ops to create the CA record before all API credentials are available. When Enabled=false, the plugin short-circuits: - Initialize: skips CscGlobalClient construction (no valid creds needed) - Ping: no-op, logs a warning - ValidateCAConnectionInfo / ValidateProductInfo: skip validation - Synchronize: completes the buffer immediately - Enroll: returns FAILED with a clear message - Revoke: throws InvalidOperationException with a clear message Default is true so existing deployments that don't set the key continue to function without change. Reads the value from incoming connectionInfo in the Validate* methods so an operator editing the CA sees consistent behavior with the current form state.
* 200 day renewal fixes * Update generated docs * Improved logging .net 10 support * Removed Template Sync Logic * Update generated docs * fixed template mapping issue * product fixes * Update generated docs * fixed renewal issue * documentation fixes * Update generated docs * DNS Changes * Update generated docs * dns code updates * Update generated docs * change type * Update generated docs * fixed mismatch * Use 'cname' validation type for CSC CNAME DCV CSC DCV requires a CNAME record, so resolve a DNS provider advertising the 'cname' validation type (e.g. GoDaddyCnameDomainValidator) rather than the ACME 'dns-01'/TXT variant. Docs updated to call out the CNAME validator and warn against selecting the TXT validator for CSC domains. * Update generated docs * added polling to grab cert * Update generated docs * Update integration-manifest.json * Update CSCGlobalCAPlugin.csproj * Update CSCGlobalCAPlugin.csproj * Update keyfactor-bootstrap-workflow-v3.yml * docs: auto-generate README and documentation [skip ci] * Add Enabled CA connection flag Adds the standard Enabled boolean field to the CA Connection settings, matching the pattern used by every other Keyfactor CA plugin (SSL Store, Digicert, HydrantId, GCP CAS, Idnomic, etc.). Purpose: allow ops to create the CA record before all API credentials are available. When Enabled=false, the plugin short-circuits: - Initialize: skips CscGlobalClient construction (no valid creds needed) - Ping: no-op, logs a warning - ValidateCAConnectionInfo / ValidateProductInfo: skip validation - Synchronize: completes the buffer immediately - Enroll: returns FAILED with a clear message - Revoke: throws InvalidOperationException with a clear message Default is true so existing deployments that don't set the key continue to function without change. Reads the value from incoming connectionInfo in the Validate* methods so an operator editing the CA sees consistent behavior with the current form state. * docs: auto-generate README and documentation [skip ci] --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
…e/ev-ov-dv-multiname-certs
Ports the following from feature/ev-ov-dv-multiname-certs, adapted to
this branch's existing patterns (ProductIdToCodeMap/CodeToProductIdMap,
structured logging style) rather than overwriting them:
- Renamed all certificate product IDs to CSC's current certificate
type names, with pre-1.2.0 legacy names still accepted (added as
additional entries in the existing product-id maps, not a separate
alias layer) so existing Certificate Templates in Command keep
working.
- Added the 3 new certificate products: CSC TrustedSecure EV, Multiple
Names; OV Wildcard, Multiple Names; DV Wildcard, Multiple Names
(types 7/8/9).
- Replaced the hardcoded certificateType == "2"/"3" checks with
MultiNameCertificateTypes/EvCertificateTypes sets covering all
applicable types.
- ValidateProductInfo now calls RequestManager.IsKnownProductId
instead of checking a separate list, so accepted names can't drift
out of sync with what GetCertificateType actually resolves.
- Fixed the "Addtl Sans Comma Separated DCV Emails" field never being
read (typo'd lookup key: "DVC" instead of "DCV"), and added a
fallback to the primary CN's DCV email when no per-domain SAN email
override matches (CSC Global rejects requests with a SAN missing
domainControlValidation).
- Fixed a case-sensitivity bug ("priorcertsn" vs "PriorCertSN") that
silently prevented PriorCertSN from ever being read during
Renew/Reissue.
- Made Price.Total nullable to fix a JSON deserialization crash when
CSC Global returns "price.total": null.
- Updated integration-manifest.json and docsource/configuration.md to
match.
Explicitly NOT ported (per discussion - these don't fit this branch):
- FlowLogger changes/redesign - this branch's FlowLogger has an
incompatible tree-based design already wired into DNS-01 CNAME
auto-publish call sites; left untouched.
- The EnrollmentContext "Flow Summary" UX feature - this branch's
TryPublishCnameDcvAsync treats EnrollmentContext entries as real DNS
records to auto-publish; adding non-DNS entries there would be
actively harmful.
- .NET 6/8 multi-targeting - this branch already moved to net10.0-only
with newer package versions; not reintroducing the older targets.
- The Renew/Reissue GENERATED-vs-EXTERNALVALIDATION fix - already
present independently on this branch.
Also adds a new xUnit test project (this branch had none), with fresh
tests written against this branch's actual code shape rather than
adapted from the other branch's now-incompatible test suite: 40 tests
covering certificate type/SAN/EV routing for all 10 canonical + 7
legacy product names, IsKnownProductId, the DCV email fallback fix,
Price.Total null deserialization, and Renew/Reissue status codes.
Adds testability seams (matching the pattern already used for HTTP
mocking in feature/ev-ov-dv-multiname-certs):
- CSCGlobalCAPlugin.CscGlobalClient property is now internal instead
of private, so tests can inject a mock ICscGlobalClient.
- CscGlobalClient gets an internal HttpMessageHandler-accepting
constructor overload, so tests can supply a fake handler instead of
making real HTTP calls.
- AssemblyInfo.cs adds InternalsVisibleTo("CSCGlobalCAPlugin.Tests").
Expands the test suite from 40 to 233 tests, covering:
- RequestManager: all certificate-type/SAN/EV routing (canonical +
legacy names), IsKnownProductId, DCV email fallback, GetRevokeResult,
MapReturnStatus/MapCertificateTypeToProductId, custom fields,
Price.Total null deserialization.
- CscGlobalClient: all 7 API methods (success/400/error paths) via a
fake HttpMessageHandler, plus constructor validation.
- FlowLogger: Step/StepAsync/Fail/Skip/Branch/Dispose.
- CSCGlobalCAPlugin: Initialize, GetSingleRecord, Synchronize/
SyncCertificates, Revoke, Ping, ValidateCAConnectionInfo/
ValidateProductInfo, Enroll (New and RenewOrReissue - renewal vs.
reissue decision, DNS-01 CNAME auto-publish via IDomainValidatorFactory,
synchronous issuance polling via DcvPollTimeoutSeconds, and the
various failure branches), and the PEM/leaf-certificate parsing
helpers (GetEndEntityCertificate/ExtractCertificates/FindLeaf).
Line coverage: 15.57% -> 95.62%. Remaining gaps are dead code
(ExportCollectionToPem, RetryCountExceededException - both already
unused before this change) and a few defensive catch blocks for
exception types (AggregateException, arbitrary X509 export failures)
that aren't reachable through normal async/mock-based testing.
Added targeted tests for previously-uncovered conditional branches across RequestManager, CSCGlobalCAPlugin, and CscGlobalClient - optional-field mapping in the registration/renewal/reissue request builders, null-valued config keys, null-object constructor inputs, and a few edge cases in the renewal/reissue decision and DNS auto-publish paths. Left purely diagnostic logging ternaries and practically-unreachable defensive branches alone.
…erts Port product rename, new cert types, and bug fixes from ev-ov-dv-multiname-certs
Resolves conflicts by keeping feature/dns-plugins' side throughout: release-2.0 only carries an older snapshot of this code (legacy-only product names, the still-present PriorCertSN case-sensitivity bug, the typo'd DCV email SAN key, and the pre-DI-seam client constructor), all of which are already fixed and superseded on this branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge feature/dns-plugins to main - Automated PR